What’s Vulnerable › Vulnerabilities

CVE-2022-39203: Parsing issue in matrix-org/node-irc leading to room takeovers

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-09-13 · updated 2026-06-17
• Weakness: CWE-269

Description

matrix-appservice-irc is an open source Node.js IRC bridge for Matrix. Attackers can specify a specific string of characters, which would confuse the bridge into combining an attacker-owned channel and an existing channel, allowing them to grant themselves permissions in the channel. The vulnerability has been patched in matrix-appservice-irc 0.35.0. As a workaround operators may disable dynamic channel joining via `dynamicChannels.enabled` to prevent users from joining new channels, which prevents any new channels being bridged outside of what is already bridged, and what is specified in the config.

Affected products

• matrix-org matrix-appservice-irc: before 0.35.0 — fixed in 0.35.0

How to fix

Upgrade to a fixed version: matrix-org matrix-appservice-irc 0.35.0. Check the vendor advisory for mitigations.

References

• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvw
• https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/
• https://github.com/matrix-org/matrix-appservice-irc/security/advisories/GHSA-xvqg-mv25-rwvw
• https://matrix.org/blog/2022/09/13/security-release-of-matrix-appservice-irc-0-35-0-high-severity/

Get alerted when CVE-2022-39203 or the next vulnerability affects your stack